Let your agents work unattended, with clear boundaries.
The tiers, gates, role files and failure classes from a kanban-driven agent fleet that has run daily since March 2026, written down so you do not have to learn them from your own outages.
One-time payment. Checkout and instant download through Gumroad. Built with AI assistance.
What you get
- Autonomy tiers. Classify actions by reversibility (A, B, C), set a trust tier per project, route finished work to auto-complete or review by rule.
- QA and intake gates. What may enter the queue, what counts as done, and why work sent to review is only signed off by a separate reviewer.
- Soul and role files. One identity file and many process files, with copy-paste templates.
- SLO and outcome machinery. Catch false completes, stale work and cost drift.
- A failure-class catalogue. Symptom, root cause, detection, guard and one-line rule for each class.
- Governance. Charter files, pause flags, human overrules, delegating ownership without delegating authority.
- A sanitization checklist and gate for anything you derive from a private system.
Scaffold edition
A zero-dependency starter (Python standard library, SQLite, bash): a local board API bound to 127.0.0.1 with bearer auth on every endpoint, gates enforced in code, an autonomy router, a one-cycle runner with a stub backend and an experimental, unverified claude -p backend, tests and CI. Boots and runs one cycle in seconds on a Mac.
Free sample: classifying actions
The opening section of the autonomy-tiers chapter, unchanged.
Two questions classify an action: can it be undone locally, and can it affect anyone besides the operator? Three categories follow, plus a hard-block list.
Category A, reversible-local: no gate. File edits inside the working tree, read-only queries, commits and pushes to your own main branch, calls to services on the local machine, any read-only tool. A wrong move here is fixed by a revert or a re-run. Friction here is pure cost.
Category B, irreversible-local: route to review at any tier. Deleting files that are not in version control, destructive schema changes (dropping or truncating), force-pushing or rebasing pushed history, permanently deleting agent state without a backup. The action may run, but the work item never auto-completes. The rule is "a human reviews the outcome," not "forbid."
Category C, external-effect: confirm before executing. Messages to anyone other than the operator, invites to outside attendees, purchases, webhooks to third-party production services, deploys to infrastructure you do not run yourself. The agent stops before acting: it marks the item blocked with a reason naming the exact confirmation needed, then moves to other work.
Hard-blocked. Bulk deletes, privilege escalation, process-killing commands, and writes to system directories are denied in the agent's tool configuration. If an agent needs one, the instruction is to use the safe alternative, and if none exists, block the item.
The classification lives in a table with four columns per tool: reversible (yes or no), external visibility (none, operator-only, external), blast radius (local, operator-only, external-read, external-write), and the resulting gate. Two details earned their keep. Classify the operation, not the tool: an outside-API tool is external-read when it fetches and external-write when it submits, so give it two rows. And classify by who is affected: a notification to the operator is category A, while the identical call to another recipient is category C.
One honest limit: only the hard-block list is enforced by tool configuration. The rest is a reference agents read, so the routing rules below act as a second layer.
Straight answers
Is this a framework or a service?
Neither. It is documents, templates and (in the Scaffold edition) a small starter repo. You read it and copy what fits.
Does it come with support or updates?
No. It is sold as-is: one version, no updates, no support channel, no custom work. That is how it stays cheap.
Is it a security boundary?
No. Gates catch common mistakes; they do not stop a determined bypass. Keep your own permission prompts, review and CI.
Who wrote it?
NocturnalKit, a pseudonymous publisher. The playbook was drafted by AI agents from a real running system and checked against it.
What do I need?
Markdown reader. Scaffold edition: Python 3.9+ and bash on macOS or Linux (Windows untested). The claude -p backend needs your own Claude Code install.
Playbook $39. Playbook + Scaffold $79. Instant download.